External risk intelligence

Firefox Storage Cache API Sandbox Escape

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-124859

This vulnerability exists within the browser's sandbox implementation, specifically affecting client-side components like the Cache API. It requires a user to navigate to malicious content within the browser application itself to be triggered. It is not a network-facing service, edge gateway, or externally reachable infrastructure component, making public internet exposure in a traditional server-side sense inapplicable.

Buffer Overflow

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in the Storage: Cache API component of Firefox, allowing for sandbox escapes. This could potentially lead to severe compromise of user data and system integrity if exploited through malicious web content.

Allows code to break out of browser sandbox.
Significant potential for data compromise.
Confirm relevance to assess risk.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious website. This website would interact with the browser's Storage: Cache API, triggering a flaw in how it handles boundaries. If successful, this could allow the attacker to escape the browser's security sandbox, potentially leading to significant compromise.

No special access needed.
Malicious website interaction.
Sandbox escape to high compromise.

Live Threat

Current exploitation, exposure, and threat context

A sandbox escape in the Storage: Cache API could allow an attacker to access or modify sensitive information and execute arbitrary code when a user interacts with malicious content in a supported browser. This could impact user data, system integrity, and service availability.

User data and system integrity.
Through malicious web content.
Data compromise and arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the Storage: Cache API component of Firefox could allow an attacker to escape the browser sandbox. Identifying all deployed instances of affected Firefox versions and confirming their exposure to untrusted content is the crucial first step. Planning remediation should then be prioritized based on risk, potentially involving coordination with vendor management if direct patching is not immediately feasible.

Application owners, platform teams, and security teams.
Confirm affected Firefox deployments and exposure.
Plan remediation based on risk and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Firefox Storage: Cache API?

The Storage: Cache API is a feature within Firefox that allows websites to store network requests and responses locally. It helps browsers load content faster and function offline by managing data caches. Because it handles incoming web data, it must operate within a strict security sandbox to prevent malicious content from accessing your computer's files or system resources.

What does sandbox escape mean for CVE-2026-124859?

A sandbox escape means the vulnerability allows code to break out of the browser's restricted environment. Normally, the sandbox is a protective wall that keeps web content from affecting your broader system. CWE-120, the weakness class involved, relates to incorrect boundary conditions, meaning the browser fails to properly limit the actions of the Cache API, letting a malicious script potentially bypass those security walls.

How is CVE-2026-124859 triggered?

This vulnerability is triggered when a user visits a malicious website that interacts specifically with the browser's Cache API. It does not trigger through background network traffic or while the browser is idle. It requires an active user interaction, such as navigating to a site designed to exploit these boundary errors.

Is my browser at risk if it is not internet-facing?

Halo Surface Signal indicates this vulnerability is unlikely to be triggered by external network scanning or automated attacks because it is a client-side browser issue, not a server-side service. The primary risk comes from the browser application itself interacting with untrusted web content, rather than an attacker connecting to a port or infrastructure component on your machine.

How do I fix the vulnerability in my Firefox deployment?

The first step is to identify where Firefox is installed in your environment and check if the versions are older than Firefox 160, Firefox ESR 115.45, or Firefox ESR 153.7. Once you locate affected instances, you should plan to update them to these versions or newer to implement the provided security fix.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.